Tenda O3 CVE-2025-12214

Exploitation targets the SetValue/GetValue function of the /goform/sysAutoReboot endpoint (the auto-reboot scheduling feature) on Tenda O3 firmware 1.0.0.10(2478); the attacker manipulates the 'enable' argument to trigger a stack-based buffer overflow. The CVSS 4.0 vector's PR:L means valid low-privilege web-interface authentication is required, which is the primary limiting factor - this is not an unauthenticated drive-by, though consumer CPE often ships with default or weak credentials that can satisfy this prerequisite. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N), so a reachable management interface plus any valid low-level account is sufficient; devices behind proper network segmentation with strong credentials are substantially less exposed.

Signals are mixed and point to a real-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-privilege but network-reachable flaw with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), consistent with full device compromise via a stack buffer overflow. Working against prioritization: the attack requires existing low-level authentication (PR:L), not an unauthenticated vector, so it cannot be fired blindly at exposed devices without credentials or a chained auth bypass. EPSS is only 0.80% (55th percentile), indicating low modeled probability of near-term broad exploitation despite a public exploit (E:P / POC available). The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. Net: publicly available exploit code exists and the technical impact is severe, but the authentication requirement plus a niche consumer/outdoor-CPE product footprint make this a moderate priority rather than an emergency - patch on a normal cycle, prioritize where O3 devices are internet-exposed with weak/default credentials.

An attacker who already holds low-privilege web credentials (or has leveraged default/weak credentials common on consumer CPE) sends a crafted request to /goform/sysAutoReboot with a manipulated 'enable' argument, overflowing a stack buffer in the SetValue/GetValue handler. A public proof-of-concept exists, lowering the skill needed, and successful exploitation can crash the device or execute attacker-controlled code on the router.